Privacy Policy

Who we are

ModelGo (the ‘Platform’) is a Saudi online platform that connects models, talent and content creators with brands, photographers, agencies, production companies and other professionals. It offers castings and applications, online bookings and payments, Premium subscriptions, a Marketplace of services and the Model Academy.

The Platform is operated by ModelGo Technology Co. (LLC), registered in the Kingdom of Saudi Arabia under Commercial Registration No. 1010XXXXXX and based in Riyadh (‘ModelGo’, ‘we’ or ‘us’). ModelGo is the controller responsible for your personal data under the Personal Data Protection Law and its implementing regulations.

This policy applies to everyone who uses the Platform — models and talent, professionals and visitors — and should be read together with the Terms of Use that apply to you.

Data we collect

We collect data you give us directly and data generated when you use the Platform, limited to what we actually need to provide our services:

• Account data: name, email address, mobile number, date of birth, gender, city, account type and your password, which we store in a hashed form that cannot be reversed.
• Profile data: photos and videos, measurements and physical details such as height, clothing and shoe sizes and hair and eye colour, experience, languages and skills, links to your social media accounts and anything else you choose to add.
• Business data for professionals: business name and logo, website, commercial registration or freelance permit where applicable, and details of the person authorised to manage the account.
• Messages and content: messages exchanged on the Platform, casting applications, reviews, reports and your correspondence with our support team.
• Booking and payment data: details of bookings, subscriptions, purchases and invoices. Payments are handled by licensed payment service providers and we never store your full card number; we receive a transaction reference, the last four digits of the card and, if you receive payouts, your IBAN.
• Identity verification data: for some features only — such as the verified badge, receiving payouts and castings involving minors — we may ask for your national ID or iqama, commercial registration and a selfie for matching. We treat this data as sensitive data.
• Device and usage data: IP address, device, browser and operating system, language, pages visited, log-in times, approximate location derived from your IP address, and data collected by cookies as described in this policy.

We do not ask for information about your religious beliefs, health, or racial or tribal origin, and we ask you not to include it in your profile or messages.

How we use your data

• To create and manage your account and show your profile to other members according to the visibility settings you choose.
• To run castings, applications and messaging, and to suggest suitable opportunities or talent based on details, location and interests.
• To process bookings, subscriptions and purchases, pay out earnings and issue tax invoices.
• To verify members and businesses, review castings involving minors, prevent fraud and misuse, and keep members and the Platform safe.
• To answer your questions and reports and send service notifications about your account and bookings.
• To analyse how the Platform is used so we can improve it and build new features, using aggregated or de-identified data wherever possible.
• To send marketing messages and offers, only with your consent, which you can withdraw at any time.
• To meet our legal obligations, such as tax and accounting requirements and responding to requests from competent authorities.

We do not sell your personal data, and we do not use it to make fully automated decisions that significantly affect you without human review.

Legal bases for processing

We process your personal data on one of the bases permitted by the Personal Data Protection Law and its regulations:

• Consent: for example marketing messages, optional cookies, processing sensitive verification data and a guardian's consent for a minor's account. You may withdraw consent at any time; this does not affect processing carried out before you withdrew it.
• Performance of a contract: to provide the services you asked for under the Terms of Use, such as running your account, casting applications, bookings and payments.
• Legal obligation: where applicable laws require it, such as keeping tax records under the requirements of the Zakat, Tax and Customs Authority (ZATCA) or responding to a lawful request from a competent authority.
• Legitimate interest: such as protecting the Platform against fraud and attacks and improving our services, provided this does not override your rights and interests and does not involve sensitive data.

Who we share your data with

We only share your data to the extent necessary and for the purposes described in this policy:

• Other members: your profile is shown according to the visibility settings you control, and when you apply to a casting its publisher sees your profile and application. Direct contact details are only shared once a booking is confirmed or with your permission.
• Payment service providers: providers licensed by the Saudi Central Bank (SAMA) that process payments and payouts on our behalf.
• Hosting and technology providers: such as cloud hosting, email, SMS, support and analytics tools, under agreements that require them to protect the data and not use it for their own purposes.
• Professional advisers: such as accountants, auditors and lawyers, where needed and under confidentiality obligations.
• Competent government and judicial authorities: when a law, court order or official request requires it, or to protect someone's safety or prevent a crime, including matters under the Anti-Cyber Crime Law.
• If the company merges, is acquired or sells its assets, data may pass to the new owner, which must protect it in line with this policy; we will tell you in advance.

Transfers outside the Kingdom

We aim to store and process your data inside the Kingdom of Saudi Arabia wherever possible. If providing the service requires transferring or disclosing some data to a party outside the Kingdom — for example certain technology providers — we only do so under the conditions set by the Personal Data Protection Law and the regulations on transferring personal data outside the Kingdom, including that:

• the recipient provides an appropriate level of protection no lower than that required in the Kingdom, or appropriate safeguards such as approved contractual clauses are in place;
• only the minimum data needed for the purpose is transferred; and
• the transfer does not affect national security or the vital interests of the Kingdom.

How long we keep data

We keep your data while your account is active or for as long as it is needed for the purposes in this policy, then securely destroy it or make it anonymous.

• When you delete your account we remove your profile from view immediately and destroy or anonymise the rest of its data within 90 days, unless the law requires us to keep it longer.
• Invoices and financial records: kept for the period required by applicable tax and commercial laws.
• Identity verification documents: destroyed within 30 days after verification is completed; we keep only the result and date of the check.
• Messages and data linked to a report, dispute or investigation: kept until it is resolved and any relevant legal time limits have passed.
• Backups: overwritten on a rolling basis, so deleted data disappears from them within 35 days.

Cookies and similar technologies

We use cookies and similar technologies, such as local storage in your browser, to run the Platform and improve your experience. They fall into two groups:

• Essential cookies: needed for the Platform to work and cannot be switched off — for example keeping you signed in, protecting forms and accounts, remembering your language and remembering your cookie choice.
• Optional cookies: analytics and performance cookies that help us understand how the Platform is used, and marketing cookies that measure how well our campaigns work. We only turn them on with your consent.

On your first visit, a cookie banner gives you two options: ‘Essential only’ or ‘Accept all’. You can change your choice at any time using the ‘Cookie settings’ button at the bottom of this page.

You can also set your browser to delete or block cookies, although blocking essential cookies may stop some features of the Platform from working.

How we protect your data

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure, including:

• Encrypting the connection between your device and the Platform, and storing passwords in hashed form.
• Limiting access to staff and providers who need it for their work, all bound by confidentiality.
• Security monitoring, regular testing of our systems and documented incident response procedures.

If a breach or incident affects your personal data, we will notify the Saudi Data & AI Authority (SDAIA) and, where required, you, within the time limits and following the procedures set by law.

Because no system is completely secure, please use a strong password unique to the Platform, never share it, and tell us straight away if you suspect someone has accessed your account.

Minors

The Platform is mainly intended for people aged 18 and over. A profile for talent under 18 may only be created and managed by their parent or legal guardian, who must give explicit consent and take responsibility for the account.

• We collect the minimum data about a minor, never display their contact details, and route all messages about them to the guardian.
• Every casting involving minors is reviewed manually by our team before it is published, and we verify the guardian's identity before any booking is confirmed.
• The guardian may exercise all the rights in this policy on the minor's behalf, including asking for the profile to be deleted at any time.

If we learn that we have collected a minor's data without a guardian's consent, we will delete it as soon as possible. If you are aware of such a case, please contact privacy@modelgo.sa.

Your rights

The Personal Data Protection Law gives you a number of rights over your data, including:

• The right to be informed about how and why your data is collected and processed — which is the purpose of this policy.
• The right to access your data.
• The right to obtain a copy of your data in a clear, readable format.
• The right to correct, update or complete your data.
• The right to ask for your data to be destroyed when it is no longer needed, subject to what the law requires us to keep.
• The right to withdraw your consent at any time where processing is based on consent.
• The right to object to and stop marketing messages.

How to exercise your rights

• You can change most of your data and your visibility and notification settings directly in your account settings, and unsubscribe from marketing using the link in every message.
• For any other request, email privacy@modelgo.sa from the address registered on your account, explaining what you need.
• We may ask for additional information to verify your identity, to protect your data from unauthorised requests.
• We will respond within 30 days of receiving your request. If more time is needed within the limits allowed by law, we will tell you and explain why.
• These requests are free of charge. We may decline a request that is unreasonably repetitive, unlawful or harmful to the rights of others, and we will explain why.

Contact and complaints

For any question or concern about this policy or how we handle your data, contact our data protection officer:

• Email: privacy@modelgo.sa
• Address: ModelGo Technology Co. (LLC), King Fahd Road, Al Olaya, Riyadh 12214, Kingdom of Saudi Arabia

We aim to resolve every complaint quickly and amicably. If you are not satisfied with our response, you have the right to complain to the Saudi Data & AI Authority (SDAIA), the authority responsible for overseeing the Personal Data Protection Law.

Changes to this policy

We may update this policy from time to time to reflect changes to our services or the law, and we will publish the updated version on this page with the date of the last update.

If the changes are significant, we will notify you by email or on the Platform at least 15 days before they take effect, and ask for your consent again where the law requires it.